The Pentagon is notifying more than 2 million current and former military members that their personnel records, which include Social Security numbers and occupational specialties, were stolen during a monthslong compromise of a Defense Department network starting last October. This incident marks the second major federal agency breach in recent months, following a separate cyberattack where the ransomware group ShinyHunters claimed to have stolen records of thousands of FBI employees.
Compromise of the Defense Manpower Data Center System
The Pentagon breach targeted a system operated by the Defense Manpower Data Center, which collates Department of Defense personnel records. Hackers gained access to the infrastructure starting last October and maintained a foothold for months before discovery. The breach compromised the records of 2.8 million living individuals.
Notification letters posted to Reddit reveal the extensive nature of the stolen data. The exposed files contained Social Security numbers, names, addresses, sex, race, and occupational specialty. Foreign intelligence agencies could find the occupational specialty data particularly valuable for identifying high-value military personnel.
ShinyHunters Claims Theft of FBI Employee Records
This incident follows a major network breach from the previous month involving federal law enforcement. The ransomware group ShinyHunters claimed it hacked into FBI systems and stole records detailing thousands of the agency’s current and former employees. Reuters reported that the job titles found within those stolen records included positions related to investigating China and Russia.
ShinyHunters asserted that it has no plans to release the stolen information. However, security analysts treat promises from a criminal organization responsible for hacking and extorting hundreds of organizations with skepticism. Furthermore, the group’s cyber defenses are likely no match against nation-state intelligence hackers.
Official Responses and Unanswered Questions
In response to the FBI system intrusion, an FBI official publicly called on group members to turn themselves in. Meanwhile, affected military members continue to receive notification letters regarding the Defense Manpower Data Center compromise. Authorities have not yet publicly attributed the Pentagon breach to a specific state-sponsored hacking collective or ransomware operation.
